linux-stable.git/net/netfilter/xt_connbytes.c, branch v3.2

netfilter: xt_connbytes: handle negation correctly

2011-12-23T13:50:19+00:00

"! --connbytes 23:42" should match if the packet/byte count is not in range.

As there is no explict "invert match" toggle in the match structure,
userspace swaps the from and to arguments
(i.e., as if "--connbytes 42:23" were given).

However, "what <= 23 && what >= 42" will always be false.

Change things so we use "||" in case "from" is larger than "to".

This change may look like it breaks backwards compatibility when "to" is 0.
However, older iptables binaries will refuse "connbytes 42:0",
and current releases treat it to mean "! --connbytes 0:42",
so we should be fine.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_connbytes: Force CT accounting to be enabled

2010-06-25T12:44:07+00:00

Check at rule install time that CT accounting is enabled. Force it
to be enabled if not while also emitting a warning since this is not
the default state.

This is in preparation for deprecating CONFIG_NF_CT_ACCT upon which
CONFIG_NETFILTER_XT_MATCH_CONNBYTES depended being set.

Added 2 CT accounting support functions:

nf_ct_acct_enabled() - Get CT accounting state.
nf_ct_set_acct() - Enable/disable CT accountuing.

Signed-off-by: Tim Gardner 
Acked-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11T16:33:37+00:00

In future, layer-3 matches will be an xt module of their own, and
need to set the fragoff and thoff fields. Adding more pointers would
needlessy increase memory requirements (esp. so for 64-bit, where
pointers are wider).

Signed-off-by: Jan Engelhardt

netfilter: xtables: substitute temporary defines by final name

2010-05-11T16:31:17+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: shorten up return clause

2010-03-25T15:56:09+00:00

The return value of nf_ct_l3proto_get can directly be returned even in
the case of success.

Signed-off-by: Jan Engelhardt

netfilter: xtables: slightly better error reporting

2010-03-25T15:56:09+00:00

When extended status codes are available, such as ENOMEM on failed
allocations, or subsequent functions (e.g. nf_ct_get_l3proto), passing
them up to userspace seems like a good idea compared to just always
EINVAL.

Signed-off-by: Jan Engelhardt

netfilter: xtables: change matches to return error code

2010-03-25T15:55:24+00:00

The following semantic patch does part of the transformation:
// 
@ rule1 @
struct xt_match ops;
identifier check;
@@
 ops.checkentry = check;

@@
identifier rule1.check;
@@
 check(...) { <...
-return true;
+return 0;
 ...> }

@@
identifier rule1.check;
@@
 check(...) { <...
-return false;
+return -EINVAL;
 ...> }
// 

Signed-off-by: Jan Engelhardt

netfilter: xtables: change xt_match.checkentry return type

2010-03-25T15:03:13+00:00

Restore function signatures from bool to int so that we can report
memory allocation failures or similar using -ENOMEM rather than
always having to pass -EINVAL back.

This semantic patch may not be too precise (checking for functions
that use xt_mtchk_param rather than functions referenced by
xt_match.checkentry), but reviewed, it produced the intended result.

// 
@@
type bool;
identifier check, par;
@@
-bool check
+int check
 (struct xt_mtchk_param *par) { ... }
// 

Signed-off-by: Jan Engelhardt

netfilter: xt extensions: use pr_

2010-03-18T13:20:07+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: cut down on static data for family-independent extensions

2008-10-08T09:35:20+00:00

Using ->family in struct xt_*_param, multiple struct xt_{match,target}
can be squashed together.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy